Slashdot Mirror
BitTorrent Unveils Secure Chat To Counter 'NSA Dragnet Surveillance'
Hugh Pickens DOT Com writes "Jacob Kastrenakes reports on The Verge that as part a response to the NSA's wide-reaching surveillance programs, BitTorrent is unveiling a secure messaging service that will use public key encryption, forward secrecy, and a distributed hash table so that chats will be individually encrypted and won't be stored on some company's server. 'It's become increasingly clear that we need to devote hackathons, hours and resources to developing a messaging app that protects user privacy,' says Christian Averill, BitTorrent's director of communications. Because most current chat services rely on central servers to facilitate the exchange of messages, 'they're vulnerable: to hackers, to NSA dragnet surveillance sweeps.' BitTorrent chat aims to avoid those vulnerabilities through its encryption methods and decentralized infrastructure. Rather than checking in with one specific server, users of BitTorrent chat will collectively help each other figure out where to route messages to. In order to get started chatting, you'll just need to give someone else your public key — effectively your identifier. Exchanging public keys doesn't sound like the simplest way to begin a chat, but Averill says that BitTorrent hopes to make it easy enough for anyone interested. 'What we're going to do is to make sure there are options for how this is set up,' says Averill. 'This way it will appeal to the more privacy conscious consumer as well as the less technically inclined.' For now, it remains in a private testing phase that interested users can apply for access to. There's no word on when it'll be open to everyone, but with all of the recent surveillance revelations, it's easy to imagine that some people will be eager to get started."
How is this different from OTR?
You can't trust a closed source "security" app.
Hey, guys, I got this wheel, and I don't like it. Somebody help make a new one with more corners please!
Started a shit-storm at AOL..... It was called WASTE...
If the public/private key pair is created at account creation, then people accustomed to everything being in the cloud will frequently forget to backup their private key (which isn't stored on any central server). A common occurrence will be "Hey Alice, it's Bob. I lost my private key so this is my new account now." Potentially, Bob is in jail and a fed is masquerading as him.
Also from my experience with DHT, it doesn't work unless you already know an IP running the protocol -- who you usually find through, yes, a centralized server. If that server were TOR-based it might work, but then that raises the question of what functionality is added by this protocol that a messaging program running thru TOR doesn't offer. Having Mixmaster-style message queueing in addition to onion routing would offer improved resistance to topology attacks as well. I'm referring to TOR's hidden services protocol, by the way, rather than the standard web proxy where an unencrypted message would be sent to a messaging server after several encrypted hops.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
This attitude needs to go away. Now. I have EVERYTHING to hide.
I'm not exactly a crypto-guru.. but if exchanging a key with your friend to ESTABLISH secure chat.. wouldn't you first have to send that key through unencrypted channels? - assuming you are far enough away that face-to-face isn't an option (and in that case, why even use this?)
when I'm using something that supposed to be secured, I'm still taking extra precautions.
At the very least, every single connection that I'm making I scramble my MAC address.
And btw, the other day there was a news about someone got apprehended despite hiding behind a TOR - you just never know when they will come at you, and when they want to get you, they can.
If you're doing things that make them specifically target you then they'll probably get you anyway (and that's as it should be).
This new is to stop mass spying/recording of every conversation (which is what they're doing now).
No sig today...
The primary issue will be the same as for PGP (anyone use that? wait, let me rephrase that: anyone know of any non-geek people who use it?): User acceptance.
Unless it's as easy not only to use but also to add contacts as FB chat, AIM, ICQ, Skype, Google+, etc. etc. it won't get the critical mass it needs.
What good is a secure chat if you don't have anyone you can chat to?
Assorted stuff I do sometimes: Lemuria.org
Everyone should have their communications privacy by default, not having to hunt downs means to keep their privacy. Services like these end up being used mostly by paranoids and people with malicious intent. So in some respects the government officials have a point in wanting to shut down initiatives like these. On the other hand initiatives like these only exist because the government wants to control everything.
Breaking into houses takes time and resources. Much more so then if the NSA can simply watch all your chat, archive it in a huge data center in utah, and then do a search through your histories.
So when spy agencies have to work the old fashioned way, even if they disrespect the need for warrants they still can't spy on everybody. If they can just do a search through your data, they are effectively watching everyone
How many different BitTorrent clients are there? How did that happen...?
It would appear that Bittorrent the company considers the healthy bittorrent/client ecosystem to be a mistake not to be repeated. Like this chat protocol, they have also announced a P2P Streaming protcol - their implimentation will be closed source encumbered with patents that they have threated to use against anyone wishing to start an alternative open client. So even when they openly publish the protocol, it is still of no use the open source community. Don't believe me, take this quote from the horses mouth:
“We want people to use and adopt BitTorrent Live. But we aren’t planning on encouraging alternative implementation because [Insert pathetic excuse here]. We want to ensure a quality experience for all and this is the best approach for us to [i.e more pathetic excuses to close source the system],” Cohen told TorrentFreak.
So, yeah, You can read the protocol spec but try to impliment it and we will "discourage" you - i.e. use out patent(s) to clobber your OS project to oblivion. Personally I hope the open source community can take these interesting initiatives, design around the patents and make a true P2P Streaming and secure chat system ecosystem - because it appears that Bittorrent the company has fallen far from its early success of kicking off the truly open bittorrent protocol, sadly.
Much like MEGA, the other projects of BitTorrent labs (most notably - Snyc), and a whole host of pseudo-security minded programs and services popping up recently, this is sadly proprietary bullshit. Much like BitTorrent Inc absorbing uTorrent as the main client etc... they've repeatedly demonstrated that they view their greatest success - the Bit Torrent protocol itself, as a mistake to be avoided. Why did BitTorrent itself grow to be so prevalent? Exactly the thing they seem to hate - its openness. BitTorrent protocol and most of its extensions (ie DHT, uTP, PEX and more) are all free and open source, to be implemented in a variety of clients. This is its greatest strength, from the slashdot-reading hacktivist running Deluge/Transmission/rTorrent, to World of Warcraft's client updater/patcher, BitTorrent is not just a great protocol for both tracker-based and trackerless sharing, but its implementations are as wide as can be and interoperable.
I am not sure why BitTorrent Inc has decided to treat this as a weakness, and develop yet another proprietary software-as-a-service, centrally managed debacle. While there seems to be some casual lip service paid to FOSS and promises of openness, I haven't seen any examples that they're actually interested in such things. For instance, the javascript Torque API which is supposed to bring BitTorrent to the web browser, doesn't seem to be compatible with any clients aside from the official BitTorrent/uTorrent clients themselves! Other "labs" projects like Live, Surf, and Sync are similar in this regard, being designed only for approved first-party clients.
So long as this ideal reigns, I won't be using these projects. Especially when it comes to privacy and security it is simply too important than to trust a proprietary, unverifiable item of this sort. There are already a variety of projects that offer better privacy and more secure messaging - RetroShare for instance. If you're interested in some of the best, check out www.prism-break.org for a directory of privacy and security respecting, mostly FOSS, programs for many uses. Until those like BitTorrent Inc wake up and realize that openness is one of their greatest strengths, I don't see any reason to consider what they provide.
You could allow something like this to be anonymous, by allowing addressing to be a relatively poor hash that a message to you would match many people and from there signature checks could determin that the message was in fact for you. The problem comes in that any such system is open to channel poisoning.. many fake messages to a block so that the decryption time becomes costly, and/or you get so many garbage messages that you can't filter out the "real" stuff. This just shows you can do encrypted + decentralized, but not really anonymous. Any solution I've thought through has to give up one of anonymous, decentralized or full-encryption of the message envelope
Michael J. Ryan - tracker1.info